Sponsored links on Yahoo and Google host malicious rogue software

Symantec's Parveen Vashishtha claimed that while Google's problem with serving up advertisements that led to misleading applications was previously reported, code authors are now using ‘Yahoo! Sponsored Search' listings as a means to promote a misleading product called ‘Antivirus & Security'.

Symantec claimed that Antivirus-2009-new.com and Antivirus-pro-download.com are returned in Yahoo! Sponsored Search results as the latest version of AVG anti-virus, where users are asked to make a payment to buy a membership in order to obtain the product.

 
Vashishtha said: “Instead of using techniques like search engine optimisation poisoning to get the opt listing in the search engine results, attackers are using Yahoo's advertising services to display their advertisement on all websites that display Yahoo's sponsored search results.

“What is interesting to note is that these websites aren't just classic misleading application websites that allow you to download trial ware that detects non-existent threats, but are instead websites that are selling memberships. Specifically, the pages state that ‘all software is freeware and/or shareware' and one is only purchasing ‘…membership…for unlimited access to…organised website with links to third party freeware and shareware software, technical support, tutorials, and step-by-step guide'."

Malicious links that have also been created to take unsuspecting users to rogue software were also found to be promoting fake products from Apple, Adobe and Google.

Vashishtha said: “Fortunately, these sponsored listings have since been cleaned up and all websites that display sponsored search results from Yahoo, and no longer appear to be displaying these misleading advertisements. However, links to this website in forum comments and other website pages still can be found.

“A Yahoo search returned around 9,000 results and a Google search returned around 5,000 results when searching for ‘antivirus-2009-new.com'. For ‘antivirus-pro-download.com', Yahoo returned around 10,000 results and Google returned around 1,650 results.